Secure Azure-based Kubernetes Cluster with Vault Integration

Question

Pulumi · Accepted Answer

To create a secure Azure-based Kubernetes cluster with Vault integration using Pulumi, you need to set up several components:

An Azure Kubernetes Service (AKS) cluster to run your Kubernetes workloads.
Azure Key Vault to store and manage secrets and other sensitive information securely.
Vault software running within your AKS cluster to handle secrets management, utilizing Azure Key Vault as one of its secret backends.

In this Pulumi program, we will:

Create an Azure Resource Group to contain all our resources.
Provision an AKS cluster with Azure Container Service.
Set up Azure Key Vault.
Integrate Vault with AKS using Kubernetes configurations.

Note: Before running this program, ensure you have the Azure CLI installed and configured with the appropriate permissions and credentials to create these resources.

Here's a Pulumi program that achieves this:

import pulumi
import pulumi_azure as azure
import pulumi_azure_native as azure_native
import pulumi_kubernetes as k8s

# Create an Azure Resource Group
resource_group = azure_native.resources.ResourceGroup('resource_group')

# Provision an Azure Kubernetes Service cluster
aks_cluster = azure.containerservice.KubernetesCluster('aksCluster',
    resource_group_name=resource_group.name,
    default_node_pool={
        'name': 'aksagentpool',
        'nodeCount': 1,
        'vmSize': 'Standard_DS2_v2',
    },
    dns_prefix='aksk8s',
    linux_profile={
        'adminUsername': 'adminuser',
        'ssh_key': {
            'keyData': 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3d...'
        },
    },
    service_principal={
        'clientId': '', # specify the Azure AD application ID
        'clientSecret': '', # specify the Azure AD application secret
    }
)

# Set up Azure Key Vault
key_vault = azure_native.keyvault.Vault('keyVault',
    resource_group_name=resource_group.name,
    properties=azure_native.keyvault.VaultPropertiesArgs(
        tenant_id='<azure-tenant-id>', # specify the Azure tenant ID
        sku=azure_native.keyvault.SkuArgs(
            family='A',
            name='standard',
        ),
        access_policies=[],
    )
)

# Obtaining the kubeconfig from AKS
kubeconfig = pulumi.Output.all(resource_group.name, aks_cluster.name).apply(
    lambda args: azure.containerservice.list_managed_cluster_user_credentials(resource_group_name=args[0], resource_name=args[1]))

# Using the kubeconfig to connect to the Kubernetes cluster
k8s_provider = k8s.Provider('k8s', kubeconfig=kubeconfig.result.kubeconfigs[0].value)

# Here you would set up Vault on your AKS cluster and configure it to use the Azure Key Vault
# This usually involves deploying a helm chart with the appropriate values set
# For example, you might use the official Vault Helm chart and set values to integrate with Azure Key Vault

# pulumi.export('cluster_name', aks_cluster.name)
# pulumi.export('key_vault_uri', key_vault.properties.vaultUri)

# IMPORTANT: Actual Vault integration will require setting up a secure Helm chart configuration,
# which is beyond the scope of this code. You need a proper understanding of Vault and Helm charts
# to securely set this part up. This is suggested as a direction to proceed in after setting up
# the AKS cluster and Key Vault.

In the provided Pulumi program, we are defining and creating the necessary Azure resources for an AKS cluster and an Azure Key Vault. After creating these resources, you would typically proceed to deploy Vault onto the AKS cluster using a Helm chart, and you would specify the Azure Key Vault properties within the Helm chart values to set up the integration.

It is crucial to replace placeholder values such as ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3d..., <azure-tenant-id>, Azure AD application clientId and clientSecret, with actual values you obtain when setting up an Azure Service Principal, or Azure Active Directory application, which will be used by AKS to interact with other Azure resources like the Azure Key Vault.

The pulumi.export lines at the end of the script can be uncommented to output the AKS cluster name and Key Vault URI after the deployment is complete, which will be helpful for any post-configuration required.